PORTFOLIO
/

SYS-02 // CASE STUDY

FleetMDM

Enterprise Mobile Device Management platform — modernizing Headwind MDM with a Go backend, React admin console, and secure QR-based device enrollment for government-scale fleets.

GOVERNMENT MDM FULL-STACK

01 — OVERVIEW

What is FleetMDM?

FleetMDM is a full-stack modernization of Headwind MDM — an open-source Android Mobile Device Management platform. The project preserves REST API contracts for existing Android agents while replacing the legacy Java/Tomcat backend with Go and rebuilding the admin panel from AngularJS into a modern React SPA.

25+
GO MODULES
18
FRONTEND FEATURES
16
MIGRATION SPECS
~96%
API PARITY

THE CHALLENGE

Legacy stack, mission-critical uptime

Government organizations need to manage hundreds of Android devices remotely — enforcing policies, deploying apps, tracking telemetry, and enrolling new devices securely. The original Java/Tomcat monolith and AngularJS admin UI were difficult to maintain, extend, and deploy at scale.

THE SOLUTION

Phased modernization without breaking agents

Rewrite the backend in Go with clean architecture, rebuild the admin console in React + TypeScript, and maintain full REST API parity so existing Android MDM agents continue working. Docker Compose enables one-command deployment of the full stack.

02 — ARCHITECTURE

System design

Three-tier architecture: React admin SPA, Go REST API, and PostgreSQL — with Android agents communicating over secure sync endpoints.

ADMIN SPA React 18 · Vite shadcn/ui · Axios serverBackendGo Gin · JWT · Swagger /rest/public · /rest/private /rest/plugins 25+ domain modules POSTGRESQL 14 devices · configs devicestatuses ANDROID AGENT MDM Launcher APK sync · telemetry Java ref
PHASE 1–3
Auth, users & roles

Session + JWT authentication, RBAC permissions, multi-tenant customer model — foundation for all admin operations.

PHASE 4–6
Devices, apps & configurations

Full CRUD for device fleet, application catalog, and MDM policy profiles with tabbed configuration editor.

PHASE 7–8
Sync agent, QR enrollment & plugins

Android agent sync APIs, QR Device Owner provisioning, push notifications, and plugin platform (audit, messaging, deviceinfo).

PHASE 9+
Frontend integration & reliability

~96% REST parity with React admin, enrollment reliability improvements, config sync UX, and HTTPS tunnel tooling for real-device QR scans.

03 — CAPABILITIES

What the platform does

End-to-end MDM capabilities for enrolling, configuring, monitoring, and securing Android device fleets.

ENROLLMENT

QR Device Owner provisioning

Admins generate QR codes that Android devices scan to enroll as Device Owner — automating APK install, Wi-Fi config, and admin extras via /rest/public/qr/json/{key}.

  • HTTPS-required for real devices
  • APK checksum validation
  • Duplicate enrollment prevention

POLICIES

Configuration management

Tabbed MDM policy editor covering app deployment, kiosk mode, restrictions, design branding, and file attachments — synced to devices on schedule.

  • Device groups & bulk ops
  • Policy locks (spec 016)
  • Config file attachments

TELEMETRY

Device health monitoring

Agents report battery, storage, memory, network, SIM, IMEI, and custom fields via POST /rest/public/sync/info.

  • Dashboard summary stats
  • Advanced device search
  • Usage statistics

SYNC

Agent synchronization

Background sync delivers configuration updates, application settings, and notifications to enrolled devices — battery-efficient and resilient.

  • Config sync on reconnect
  • Application settings push
  • Notification polling

MULTI-TENANT

Customer control panel

Support for multiple government organizations on a single platform instance — with tenant settings, impersonation, and per-customer plugin enablement.

  • Customer CRUD
  • Tenant branding API
  • Role-based permissions

PLUGINS

Extensible plugin system

Modular plugin architecture ported from Java: audit logging, device info, device logs, messaging, and push — each with dedicated REST endpoints.

  • Plugin enable/disable per tenant
  • Audit trail
  • Remote messaging

04 — ENROLLMENT FLOW

How a device joins the fleet

From factory reset to fully managed device — the enrollment pipeline that powers government device onboarding.

STEP 01
Admin creates device

Register device in React admin panel or bulk-import fleet entries with group assignment.

STEP 02
Generate QR code

System builds Android Device Owner JSON with APK URL, SHA-256 checksum, and Wi-Fi credentials.

STEP 03
Device scans QR

On factory-reset Android: tap welcome screen 7× → scan QR → MDM launcher installs automatically.

STEP 04
First sync

Agent calls /rest/public/sync/configuration to enroll and receive initial policy.

STEP 05
Ongoing telemetry

Periodic heartbeat reports device health; admin pushes policy updates and remote commands.

05 — TECH STACK

Technologies used

Modern, production-grade stack chosen for maintainability, performance, and API parity with the legacy system.

FRONTEND

React 18 TypeScript Vite 5 React Router v6 shadcn/ui Tailwind CSS Axios Zod Chart.js i18next Vitest

BACKEND (Go)

Go 1.22 Gin PostgreSQL JWT Swagger Clean Architecture SQL Migrations TOTP 2FA QR Provisioning

INFRASTRUCTURE

Docker Compose Nginx Caddy HTTPS PostgreSQL 14 Makefile Liquibase (Java ref)

MY CONTRIBUTION

Full-stack ownership across the MDM lifecycle

Led development across the Android agent integration layer, Go backend migration, and React admin console — ensuring REST API parity, secure enrollment flows, and production-ready deployment tooling.

  • Architected and implemented Go backend modules (devices, sync, QR, push, plugins)
  • Built React admin features: device management, configuration editor, enrollment QR page
  • Designed phased Java→Go migration with 16 formal specs and 27 API parity documents
  • Implemented HTTPS enrollment tunnel for real-device QR provisioning
  • Android MDM agent integration: sync APIs, telemetry, background services, policy delivery